In The Matter Of: 

United States vs. 
PFC Bradley E. Manning 



Vol. 2 
June 4, 2013 
UNOFFICIAL DRAFT - 6/4/13 Morning Session 



Provided by Freedom of the Press Foundation 



Min-U-Script® with Word Index 



1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 



UNOFFICIAL DRAFT - 6/4/13 Morning Session 



1 

VOLUME II 
IN THE UNITED STATES ARMY 

UNITED STATES 
VS. 

MANNING, Bradley E., PFC COURT-MARTIAL 
U.S. Army, xxx— xx— 9504 

Headquarters and Headquarters Company, 

U.S. Army Garrison, 

Joint Base Myer— Henderson Hall, 

Fort Myer, VA 22211 

/ 

The Hearing in the above— titled matter was 
held on Tuesday, June 4, 2013, at 9:30 a.m., at 
Fort Meade, Maryland, before the Honorable Colonel 
Denise Lind, Judge. 
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DISCLAIMER 
This transcript was made by a court 
reporter who is not the official Government reporter, 
was not permitted to be in the actual courtroom where 
the proceedings took place, but in a media room 
listening to and watching live audio/video feed, not 
permitted to make an audio backup recording for editing 
purposes, and not having the ability to control the 
proceedings in order to produce an accurate verbatim 
transcript . 

This unedited, uncertified draft transcript 
may contain court reporting outlines that are not 
translated, notes made by the reporter for editing 
purposes, misspelled terms and names, word combinations 
that do not make sense, and missing testimony or 
colloquy due to being inaudible by the reporter. 
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PROCEEDINGS - MORNING SESSION 

THE COURT : Court is called to order . Trial 
counsel, please account for parties. 

MR. MORROW: All present with exception 
Captain Overgaard. 

THE COURT : Any issues we need to address 
before we proceed today? 

MR. COOMBS: No, Your Honor. David Shaver. 

MR. MORROW: David Shaver. 

Whereupon, 

DAVID SHAVER, 

called as a witness, having been first duly sworn to 
tell the truth, the whole truth, and nothing but the 
truth, was examined and testified as follows : 

EXAMINATION BY MR. MORROW 

BY MR. MORROW: 

Q. You are Dave Shaver, Special Agent, special 
inspector (inaudible) for the (inaudible) 

A. Yes, sir. 

Q. Special Agent Shaver, how long have you 
worked for (inaudible) 
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A. For about a year and a half, sir. 
Q. What do you (inaudible) 
A. Special agent. 

Q. What specifically, what kind of work do you 
do as special agent? 

A. Sir, my job mainly is to take digital media 
which has been generated as part of a search warrant or 
a subpoena and turn it into usable format in 
(inaudible) 

Q. Explain the (inaudible)? 

A. It's special (inaudible) 

Q. Before becoming a special agent with the 
Department of Treasury, what did you do? 

A. Sir, I was the special agent in charge for 
the research branch of Computer Crime Investigative 
Unit . 

Q. What is the Computer Crime Investigative 

Unit? 

A. It ' s a unit of CCIU main focus CCII focus 
investigate any intrusion computer (inaudible) in 
support of that mission. 
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Q. When did you begin working for Army CCIU? 
A. In 1999. 

Q. Can you describe your process throughout the 
organization there? 

A. Yes, sir. In 1999 CCIU as enlisted temp and 
2001 I left the army and 2000 early 2002 I came back to 
work for CCIU as (Inaudible) . In 2003 I became a 
(Inaudible) . 

Q. You are not a CCIU? 

A. No, sir. 

Q. (Inaudible) 

A. 2005. 

Q. Is that supervisory position? 
A. Yes, it is. 

Q. How many people did you supervise? 

A. I directly supervised five. I also supported 
about 7 8 examiners worldwide. 

Q. What kind of work did you do as special agent 
in charge of (Inaudible) ? 

A. Forensic evidence in counter intelligence 
minimum I also policies for procedures methods and also 
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(Inaudible) 

Q. What do you mean by tool validation? 

A. It's concerning digital (inaudible) tools. 
To make sure the forensic program actually did what it 
was supposed to do . Not what it was supposed to . 
Validated the findings . 

Q. Do you have any formal education? 

A. Yes, sir, I do. 

Q. From where? 

A. (Inaudible) . 

Q. What was your major there? 
A. Sociology criminology. 
Q. Background CV. (Inaudible) The CV? 
A. Simply just examination after digital media. 
Q. What is the digital media? 
THE COURT : Just a moment . 

MR . HURLEY : Accept special agent as expert 
in computer forensics. 

MR. MORROW: (Inaudible) 

THE COURT : That ' s fine . 
BY MR. MORROW: 
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Q. Special Agent shaver, what is digital media? 

A. Digital media is just that. Electronics such 
as cell phone, a computer, a server, any cell phone 
(Inaudible) . 

Q. Did you receive any certifications? 

A. Yes, sir. 

Q. What are those? 

A. First ones the (Inaudible) . Specialist 
training Georgia. Certified criminal defense center 
otherwise DC3 Maryland. (Inaudible) 

Q. Have you published any articles related to 
computer forensics? 

A. Yes, I have. 

Q. What is that? 

A. In 2009 I chapter concerning (Inaudible) 

Q. Have you attended any conferences? 

A. Yes, sir, I have. 

Q. What are those conferences? 

A. The annual Department of Defense Conference 
and the Annual Software Conference . 

Q. Did you ever receive any awards as a result 
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of your work? 

A. Yes, sir, I have. In 2009 (inaudible) award 
contribute forensic evidence, from the International 
Chief of Police. 

Q. What was that award for? 

A. Two. One was (inaudible) and criminal 
investigations and tool to examine computers to 
determine (inaudible) 

Q. What do you mean by virtual? 

A. Virtual machine in this case we would take a 
forensic item and convert it into machine so your 
computer would be considered the host and the first 
machine would be the guest . The guest computer can be 
any operating system, whether it be MAC or Windows . 
The advantage of this is to see the computer as the 
person . 

Q. (Inaudible) to see the computer desktop? 
A. Same desktops, wallpaper, same program. It 
is their computer. 

Q. Thank you. What is a forensic image? 

A. The forensic image, technically computers are 
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organized spaced lowest level (inaudible) operating 
system but I know being two test wheels . And that it 
is either a 1 or a zero that is called a bit . So 
forensic image is it's bit by forensic image. 
(Inaudible) tool would be the first zero and next byte 
with us write the one. Continue to do this until media 
has been copied . 

Q. You said forensic item. What tool is — 

A. I used EnCase for this program. 

Q. After the EnCase, what happens? 

A. (Inaudible) hash value and you think hash 
value digital fingerprint . 

Q. If two values match, what does that tell you? 

A. They are the exact same thing. 

Q. Verified hash values. What is the next step 
or examining the computer? 

A. The next step would be to answer the 
questions which is posed by (inaudible) . 

Q. You mentioned EnCase. Can you describe what 
EnCase is? 

A. EnCase is basically the standard used 
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throughout the market . Used by both government and 
corporate entities . 

Q. And who owns EnCase? 

A. That's a company (inaudible) in California. 
Q. (Inaudible) EnCase to examine or create 
images? 

A. You are allowed to view files in native 
format without altering them. Gives you the ability to 
(inaudible) spaces — (inaudible) . 

Q. Alright. What is the allocated space? 

A. Allocate space is just that, files that are 
allocated. If you create a folder on allocated. It's 
there. Unallocated are deleted files on a hard drive 
never been used. 

Q. You said allocate has never been used. Does 
EnCase or tools like that, do they allow you to see 
deleted files or files that may have existed and are 
now gone? 

A. Yes, sir. 

Q. Explain that, please. 

A. Again, if you think of a computer like a 
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library. You want to find a certain book. You go to 
the catalog. It will tell you where in the library the 
book is . 

In a computer obviously Windows is 
something (inaudible) . If you would like to view a 
file, the operating system will go down the master file 
table, locate where on the hard drive the file is and 
retrieve it for you . 

So when you delete the file, all you 
basically do is remove the entry from the master file 
table or remove the card from the catalog. If you do 
that, the book is still physically in the library but 
you can't access it. 

Q. When you say the book is still in the 
library, with the data still on the computer, are you 
always able to recover the full file or partial file? 

A. Again, once the computer erases the file 
space in the file is now free to be used for something 
else. It's free to use. If the operating system needs 
to write something, it could overwrite part or all of 
the file. 
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Q. What do you mean by overwrite? 

A. Use the space for another file. If you 
download some movies, it needs to put them somewhere, 
it may overwrite deleted files . 

MR. MORROW: At this time the United States 
offers Special Agent Shaver as expert in computer 
f orensics . 

THE COURT: Alright. 

EXAMINATION BY HURLEY 

BY MR. HURLEY: 

Q. Good morning, Mr. Shaver. 
A. Good morning. 

Q. You talked about the process of taking a 
forensic image . You would agree with me in an 
investigation that you are doing the forensic 
examination, you are going to document things? 

A. Yes, sir. 

Q . You ' re going to have guidance from another 
investigator and they are going to tell you what to 
look for? 

A. Yes, sir. 
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Q. If you find anything related to what you have 
been told to look for, you're going to document it. 

Nothing further . 
THE COURT : Redirect . 
MR. MORROW: No, Your Honor. 
THE COURT: Special Agent Shaver, you are 
temporarily excused. You cannot talk with anyone other 
than counsel while trial is still going on. 

Call your next witness. 
MR. MORROW: Yes, Your Honor. United States 
calls Mr. Mark Johnson. (Inaudible) . 
Whereupon, 

MARK JOHNSON, 

called as a witness, having been first duly sworn to 
tell the truth, the whole truth, and nothing but the 
truth, was examined and testified as follows: 

EXAMINATION BY MR. MORROW 

BY MR. MORROW: 

Q. You are Mark Johnson, Army Computer Forensic 
Investigative Unit, Army Criminal (Inaudible) 

A . I am . 
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Q. Mr. Johnson, what is your current position 
with CCIU? 

A. Digital Media Examiner. 

Q . And you work for CCIU or you work for the 
Digital Media Branch of CCIU? 

THE COURT: I'm having trouble hearing you. 
Maybe speak a little slower. 

THE WITNESS: Yes, ma'am. 
BY MR. MORROW: 

Q. Where do you work? 

A. I'm (inaudible) Question again. 

Q. Do you work for CCIU? 

A. I work for a branch, subunit of CCIU. 
Q . How long have you been in Digital 
(inaudible) ? 

A. Approximately June 2006. 
Q. Are you a special agent? 
A. No, sir. 

Q. What is your position? 
A. I'm a contract employee assigned to 
(inaudible) . 
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Q. When did you become a contract employee for 

CCIU? 

A. In June 2006. 

Q. So were you hired specifically to work at 
CCIU for your contract? 
A. Yes. 

Q. What does a digital forensic examiner do? 

A. We are responsible for examination of digital 
or media tool (inaudible) anything related to 
computers . 

Q. What do you mean by network device? 
A. (Inaudible) routers, switches, communication. 
Q. Do you hold a supervisory position at CCIU? 
A. I do. 

Q. What is that position? 
A. I (inaudible) 

Q. How many people do you supervise? 
A. I currently have two subordinates. 
Q. Do you hold any certifications in Digital 
(inaudible) ? 

A. Yes, sir. 
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Q. What are those? 

A. Certified through the (Inaudible) DC3 . I 
hold digital (Inaudible) . (Inaudible) 

Q . Do you hold any other industry 
certifications? 

A. I do. 

Q. What certifications do you hold? 
A. I am a certified information systems security 
professional also known as CCISP. 

Q. Can you explain what is CCISP? 

A. Industrial standard certification respect in 
the industry covers lots of domains related to 
(Inaudible) . 

Q. When did you obtain that certification? 

MR. HURLEY: We'll stipulate to Mr. Johnson. 
THE COURT : Do you have initial foundation 

questions? 

MR. MORROW: I'll quickly review, Your Honor. 
At this time we'll offer Mr. Johnson as 
an expert in computer f orensics . 

MR. HURLEY: No objection. 
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THE COURT: So recognized. 
BY MR. MORROW: 

Q. (Inaudible) 

A. Mr. No special agent Frederick. 
Q. (Inaudible) 
A. (Inaudible) 

Q. Prior to Special Agent Shaver, who is the 
special agent in charge of? 

A. Special agent (Inaudible) . 

Q. How long did you work with (inaudible) 

A. Since June of 2006. 

Q. Typically now and also in your work with 
Special Agent Shaver, how do you receive (inaudible) 

A. Receive a forensic request in writing that 
details what is supposed to be looking for, what 
evidence we are to look at, the type of information we 
are looking for, the legal basis and other related 
information . 

Q. Is this request for examination, is a formal 
document? 

A. Yes, sir. 
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Q. When you receive request for an examination, 
how long does a examination typically take? 

A. Anywhere from a day or two, months or years. 

Q. You said years? 

A. Yes, sir. 

Q. Why the variance? 

A. We have wide swaths of what we are looking 
for, the detail how much in— depth we need to get into. 
Also sheer volume. We have exams that (inaudible) . 
Takes a lot of time. It's not like you see on TV. 



Q. 


What is your task? 


A. 


We generate a report . 


Q. 


Where is that report sent? 


A. 


It ' s reviewed by a number of people . 


Q. 


Is it a formal report, informal report? 


A. 


Either or . 


Q. 


Why either or? 


A. 


It depends on the scope of what was needed. 



Sometimes if it ' s an examination, not likely to be any 
further investigative, it may or — however in this 
situation (Inaudible) . 
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Q. You said AI? 

A. That is a CCID format of investigative 
report . More of memo type arrangement . 

Q. In the report generating process does anyone 
review your work for accuracy? 

A. Yes, sir. 

Q. How does that process work? 

A. We have a peer review process, other 
examiners in the office review the report and the 
foundation behind it, make sure we covered everything, 
that the findings are accurate. 

Q. When you are assigned a piece of digital 
media, do you work on that alone? 

A. Not always. 

Q . Can you explain that , please . 

A. In some cases the work involves all of us or 
in the case it is a collaborative process, just like 
your teams split case when it's gets complicated. 

Q. So if you are splitting up like the 
(inaudible) digital media how does that work? 

A. Same piece of evidence. 
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Q. You say collaborative. Can you explain that, 
please. How is the office set up? 

A. We have relatively small offices. This is 
callid the (inaudible) about the size of a closet. We 
actually sit right next to each other. 

MR . MORROW : Just one moment . 

Mr. Johnson, in your involvement in this 
case did you examine any digital media associated with 
the investigation in this case? 

A. Yes, sir. 

Q. What did you observe? 

A. Forensic evidence from an external hard 
drive . 

Q . What did you say? 

A. Forensic evidence from a MAC and Pro hard 
drive, external hard drive. 
Q. What is that Pro- 
A. Apple product for laptop. 

Q. Let's start with the external. What is an 
external drive? 

A. External drive is external piece for storage 
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media, all shapes and sizes. In this case it's a 
container that contained an internal hard drive 
connected to the computer with USB. 

Q . Did you examine the actual external drive in 
this case? 

A. (Inaudible) that was collected by the 
collecting agent. 

Q. Is that the (Inaudible)? 
A. Yes, sir. 

Q . To your knowledge where was this item 
collected? 

A . PFC Manning ' s . 

Q. Who asked you to imagine an external hard 
drive? 

A. I don't recall specifically who. Ultimately 
it came from the original case unit, Agent Graham. 

Q. Let's talk about your process of examining 
the external hard drive. What did you do first? 

A. We checked out the evidence from our evidence 
lockup. Brought it back to our examination station. 
We copied it to our examination workstation. Loaded it 
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into and EnCase and validated the image is hash . 

Q. Why do you validate the image as hash? 

A. Make sure the evidence file matches what is 
originally collected. The EnCase will copy the hash 
during my examination, come up with a mathematical 
value and compare that with the value that ' s embedded 
in the file itself. We also compare that with evidence 
collection documentation. 

Q. Were there any verification issues with the 
hash value for the external hard drive that you 
examined? 

A. No, sir. 

Q . And during your examination of the external 
hard drive did you find anything of interest in this 
investigation? 

A. We did. There were three pieces of 
information that we found that might be related. 

Q. And what were those pieces of information? 

A. Text file. We found a PowerPoint 
presentation and video . 

Q. Was the text file located on the external 
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hard drive? 

A. It was stored in (Inaudible) . 

Q. When you reviewed the information in EnCase, 
were you able to determine when the file was created? 
A. Yes. 

Q. And how did you determine when the file was 
created? 

A. The file system contains operation date 
sometimes . 

Q. When is that (inaudible)? 

A. Data about data. In this case the 
information about the file itself. 

Q. How does EnCase show you that data 
essentially? Explain that, please. 

A. EnCase in this situation will show it to me 
in a spreadsheet like format . 

Q. Do you recall when this text file was 
created? 

A. To my recollection it was 29 November of 
2000 — (Inaudible) . 

Q. When you found this text file, did you review 
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the contents of the text file? 
A. I did. 

Q . I'm retrieving what has been marked as 
Prosecution Exhibit 24 for identification. 

I'm handing the witness what has been 
marked as Prosecution Exhibit 24 for identification. 
Mr. Johnson, do you recognize this document? 

A. I do. 

Q. And what is it? 

A. This is the contents of a text file 
( inaudible . ) 

Q. Does this document accurately depict the text 
file you found on the external hard disk drive? 
A. It does. 

Q. If you printed this text file as you found 
it, is this how it would appear? 
A. Yes. 

Q. Where was this file found? 
A. In the allocated (inaudible) 

Q. Move to admit Exhibit 24 for identification 
as evidence . 
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(Pause) 

BY MR. MORROW: 

Q. Mr. Johnson, you say you also found a 
PowerPoint ? 

A. Yes. 

Q. Where was this PowerPoint? 

A. Allocated file system. 

Q. Do you recall the name of the file? 

A. Not specifically. I do know it was 
(inaudible) . 

Q. So it ' s like the free (inaudible) 

Your Honor, I'm retrieving what would be 
Prosecution Exhibit 25 for identification. I'm handing 
the witness what would be Prosecution Exhibit 25 for 
identification . 

I'm handing the witness what would be 
marked as 25 for identification. Retrieving 
Prosecution Exhibit 24 . 

Mr. Johnson, do you recognize this 

document ? 

A. I do. 
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Q. What is it? 

A. It is the PowerPoint that's been opened. 
Q. (Inaudible) Open Office Presentation? 
A. Open Office is the version that would be 
PowerPoint clone . 

Q . It is a representation referring to printed 

form? 

A. Yes, sir. 

Q . I'm retrieving what would be marked as 
Prosecution Exhibit 25 for identification. 

No further questions, Your Honor. 
EXAMINATION BY MR. HURLEY 

BY MR. HURLEY: 

Q . Good morning . 
A. Good morning. 

Q. In the investigative process, the process of 
taking forensic images, and what you do with those, 
fair to say, you take a forensic image and you perform 
your investigation? 

A. Yes. 

Q. When you are doing your investigation, you 
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are going to have things that you are looking for? 
A. Yes, sir. 

Q. And when you're talking about a computer or a 
hard drive, there is a lot of different types of 
information that you can have on that particular media? 



A. 


Yes, sir. 


Q. 


Emails? 


A. 


Yes . 


Q. 


PowerPoint presentations? 


A. 


Yes . 


Q. 


Text files? 


A. 


Yes, sir. 


Q. 


All potentially valuable. They belong to, in 



all likelihood, the person who owns that particular 
media? 

A. Yes, sir. 

Q. In this particular case you were looking at 
all those, you looked at everything on this particular 
hard drive? 

A. Yes, sir. 

Q. And by this hard drive, I'm talking about the 
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external hard drive? 
A. Yes, sir. 

Q. With respect to this case there were 
particular things you were looking for. You were 
looking for anything that implicated WikiLeaks; is that 
correct? 

A. That is correct. 

Q. You found, as you talked about on direct, you 
found some contact information? 
A. Yes, sir. 

Q. You didn't find anything else on that hard 
drive that implicated WikiLeaks? 
A. I don't recall, sir. 

Q. Would you have mentioned that in your report? 
A. Yes, sir. 

Q. You would have also been looking for anything 
that would have expressed a hatred of America on that 
hard drive? 

A. It would have been noted. 

Q. You would have looked at everything on the 
hard drive? 
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A. Yes. 

Q. If you would have seen that, you certainly 
would have noted that? 
A. Yes, sir. 

Q. You didn't note that on your report? 
A. No, sir. 

Q. Because you didn't find it? 
A . Right . 

Q. You also would have noted, if you had found 
anything that related to terrorism? 
A. Yes, sir. 

Q. If there was any sort of evidence that 
suggested that my client was supporting terrorism, you 
would have noted that? 

A. Yes, sir. 

Q . You didn ' t note anything? 
A. I did not discover anything, no, sir. 
Q. You also would have made note of anything 
that would have shown a transfer of funds? 

A. If I had discovered anything, yes. 

Q. If you had found something that seemed like a 
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lot of money for a PFC to have, you would have noted 
that? 

A. Yes. 

Q. You didn't note that in this case? 
A. That is correct. 

Q. And going back to — actually, no further 
questions, Your Honor. 

THE COURT: Redirect? 

MR. MORROW: No, Your Honor. 

THE COURT: Mr. Johnson, you are temporarily 

excused . 

MR. MORROW: United States requests a 
ten-minute recess. 

THE COURT: Alright. Any objection. 
MR. HURLEY: No objection, Your Honor. 
(Brief Recess) 

THE COURT: Please be seated. Ready to 

proceed? 

MR. FEIN: Toni Edwards. Stipulation with 
respect to testimony of Special Agent Toni Edwards, 3 
January 2013. Prosecution Exhibit 26. Hereby agreed 
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defense counsel, trial counsel that if Special Agent 
Edwards were present to testify during the merits of 
the court martial, he would testify substantially to 
the following : 

Since March of 2012, I have been 
employed as special agent, Homeland Security 
Investigations, Department of Homeland Investigation 
Atlanta Field Office, empowered by law to investigate 
requests for unlawful (inaudible) of goods and 
technology to destinations outside the United States. 

Prior to working for HSI from March 2008 
to March 2012, I was employed as Special Agent with the 
(inaudible) criminal investigation U.S.A. CI Computer 
Crime Investigative Unit, CCIU, at Ft. Belvoir, 
Virginia . 

In this capacity I was responsible for 
the investigation of violations pertaining to computer 
intrusions and to other types of malicious computer 
activity directed against the United States Army, 18 
U.S.C 1030. 

Situational awareness U.S.A. CIDC 
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Special Agent I was to investigate crimes, all 
violations of the Uniform Code of Military Justice and 
other comparable Federal and State Laws where there is 
United States Army or Department of Defense interest . 

I have participated and conducted 
investigations of violations of United States Laws and 
regulations pertaining to computer intrusions and 
participated in the execution of search warrants and 
individuals and companies . 

Before working at U.S.A. CCIU from 
November 2007 to November 2008, I was employed as 
Special Agent with the Bureau of Industry and Security 
Office of (inaudible) Enforcement. And from May 2003 
to October 2006, I was a deputy prosecutor for Morgan 
County, Indiana. 

From August 2000 to August 2005, I 
served in the (inaudible) county, Indiana deputy 
sheriff's department as deputy sheriff where I received 
training in evidence collection. 

Further, I am a graduate of Federal Law 
Enforcement Training Center, Criminal Investigator 
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Training Program where I also received training in 
evidence collection. 

In addition to being employed as Special 
Agent, I currently serve inactive ready reserve as 
Judge Advocate in the national District of Columbia. 
In 2003 I received a juris doctorate from Indiana 
University and was subsequently admitted to the Indiana 
Bar . 

Bachelors of arts in psychology from the 
University of North Florida and Doctorate Juris 
Prudence from Indiana University, School of law. 
Currently licensed to practice law in Indiana. 

My experience (inaudible) as a state law 
enforcement officer, state prosecutor and Special Agent 
has included investigation of cases involving violent 
and non— violent crimes, as well as the use of 
computers . 

I have also received training and gained 
experience in interviewing and interrogation techniques 
(inaudible) crime scene examination evidence 
collection, search warrant applications and execution 
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of searches and seizures and other criminal laws and 
procedures . 

Further, I have completed the Department 
of Defense Cyber courses, introduction to computer 
hardware, computer incident response course and Windows 
forensic examination EnCase . 

Together this afforded me certification 
as Department of Defense Certified Digital Media 
Collector and (inaudible) 

(Inaudible) . I review the custody of 
document and also ensure the description of evidence. 
I check, for example, recorded serial numbers markings 
for identification and check the description match the 
associated evidence . 

I ensure the proper information such as 
date and time are properly and accurately recorded. I 
maintain secure custody of the evidence prior to 
transferring to another evidence. 

In this particular investigation I 
assisted with witness interviews and handling of 
evidence . In so doing I worked with Special Agent 
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Charles Clapper and Gary Young . 

On 12 June 2010, I received several 
pieces of electronic evidence relating to this 
investigation from the hand of Mr. Adrian Lamo and with 
his consent. On 12 June 2010, Agent Adrian Lamo 
(inaudible) also gave contained law enforcement 
personnel on two separate CID forms (inaudible) To 
serve electronic devices for all information in any 
form pertaining to communications which may be in the 
form of emails, instant message, chats, documents, data 
computer code or log files, drawings, photographs or 
any other data, encrypted plain text or any other 
format relating to PFC Manning and/or the disclosure 
classified information which is the property of United 
States Government . 

The first piece of evidence collected 
and further handled was Lenovo laptop computer with 
computer hard drive (inaudible) or DA Form 4137 marked 
as document number DN7 6— 10 and known as Lamo hard 
drive. It was collected from Mr. Lamo in Sacramento, 
California on 12-June 2010. 
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The second piece of evidence collected 
and further handled was HP mini— brand computer . Serial 
number CNU90513VK with a CD computer hard drive, hard 
drive Serial Number (inaudible) recorded as Item 1 on 
DA Form 3137 marked as document number DN77— 10 and 
known as Lamo HP hard drive . It was collected from 
(inaudible) Sacramento, California, 12 June 2010. 

Using the DA form I released these 
pieces of evidence to Special Agent Clapper. On 14 
June, I properly regained possession from Special Agent 
Clapper before properly leaving them to the evidence 
custodian Mr. Gary Young on 15 June 2010, which is 
documented on a DA Form 4137. 

While in possession of these items I 
maintained control over them, stored them properly and 
allowed no one else to access them and did not alter 
the evidence in any way . 

I have no reason to believe this 
evidence was damaged or contaminated in any way . After 
releasing the evidence to Gary Young (inaudible) my 
knowledge Ii had no further action with the evidence. 



Provided by Freedom of the Press Foundation 



1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 



UNOFFICIAL DRAFT - 6/4/13 Morning Session 

39 

Prosecution Exhibit 13 for 
identification is a Lamo Fujitsu hard drive, Item 1 of 
DN7 6— 10 Prosecution Exhibit 14 for identification Lamo 
HP Fujitsu hard drive Item DN7710 . 

United States calls Agent Lamo . 

Whereupon, 

ADRIAN LAMO, 

called as a witness, having been first duly sworn to 
tell the truth, the whole truth, and nothing but the 
truth, was examined and testified as follows: 

EXAMINATION BY MR. FEIN 

BY MR. FEIN: 

Q. You are Mr. Lamo previously from the 
Sacramento area of California? 

A. Yes, I am. 

Q. Thank you, sir. Mr. Lamo, how do you know 
PFC Manning? 

A. From a series of conversations we had online 
in 2010. 

Q. When did you first interact with PFC Manning? 
A. On or about May 20th of 2010. 
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Q. And what was the form of that interaction? 
A. In a two— way encrypted email from PFC Bradley 
Manning . 

Q. How did you know that email was from PFC 
Bradley Manning? 

A. Based on retrieving return address common to 
all email . 

Q. What do you mean by return address 
information? 

A. Information indicating where it originated 
from which allowed the recipient to reply. 

Q. Is that an email address? 

A. Yes. 

Q. What was the email address? 
A . Bradley . e . manning@gmail . com, military 
network . 

Q. So you received multiple emails from PFC 
Manning? 

A. Yes, I did. 

Q. So the first one he said 
bradley.e.manning@gmail.com. Can you explain to the 
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Court what the second email you received, what the name 
was on the email? 

A. I'm sorry. Which one are you referencing? 

Q. The second one. The one you just mentioned, 
army email address? 

A. Yes. A string of letters numbers that 
identified (Inaudible) . 

Q. Did it have a name as beginning user name? 

A. Yes. His name was presented as user name. 

Q. What happened after you received the initial 
email? 

A. After the initial one I disregarded the 
email . After receiving several more I wrote back 
suggesting that the user should perhaps contact me via 
AOL messenger to have a Xchat . 

Q. Was this email encrypted or not? 

A. The one which I sent reply was not, to the 
best of my recollection. 

Q. Was the email that was sent to you encrypted? 

A. Yes, it was. 

Q. Would you explain to the Court what that 
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means? 

A. Encryption encodes an email to a particular 
user rather to a user site affiliate recipient is 
supposed to be able to read it . 

Q. What is a cypher? 

A. In this case public key cypher. 

Q. What do you mean by public key? 

A. Series of codes which instruct the computer 
how to encrypt the message in such a way that the 
recipient will decrypt it . 

Q. Were you able to read the initial email from 
PFC Manning? 

A . I was not . 

Q. Why not? 

A. He had specified an incorrect cipher, one 
which I formerly used but had fallen out of use. 

Q. How does one find this cypher, this code? 

A. There are a couple of trailers called 
(inaudible) servers which contain collections of keys 
so users can find themselves more easily. 

Q. And when did you then realize when you 
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started chatting this was PFC Manning? 

A. There was a particular point in our 
interactions where PFC Manning mentioned his name was 
Brad and I replied, oh, I'm an idiot. You are that guy 
from the emails . 

Q . And how did you chat with PFC Manning? 

A. By a service message — it was online called 
messenger and through a free third party program. 

Q. So what program did you use? 

A. P-I-D-G-I-N . 

Q. Could you explain briefly — so the network 
is being, you used message online instant messaging? 
A. Yes. 

Q. You did not online instant message 
programming? 

A. No. There were numerous chat lines that 
support the service but are not made (inaudible) 

Q. Were these chats encrypted? 

A. Yes, they were. 

Q. What does that mean? 

A. That to a third party intercepting them on 
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(inaudible) this would be unreadable, the intended 
party wouldn't be able to receive them. 

Q. Mr. Lamo, (inaudible) . What is your 
experience with computers networks? 

A. I have extensive experience (inaudible) 
testing that is security of computer networks 
conducting review of related to security. And finding 
ways to bypass and improve security. 

Q . And how many years of experience in this 
field have you worked? 

A. 15. 

Q. In those 15 years have you been arrested? 
A. Yes, I have. 

Q . Based on that have you been arrested based on 
activities related to that field? 
A. Yes, I have. 
Q. And what for? 

A. For unlawful access to computer networks at 
the New York Times Company, Microsoft and Lexis— Nexis . 
Q. When did this occur? 

A. The first conduct took place in 2002. The 
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arrest took place in 2003 and the conviction in 2004. 



Q 
A 

Q 

guilty 
A 
Q 



So you were convicted? 
Yes, I was. I pled guilty. 

Did you confess to those crimes when you pled 



Yes, I did. 

Going back, Mr. Lamo, when did you first 
start chatting with PFC Manning? 

A. On or about May 20th, 2010. 

Q. How did you know once the chat started that 
it was, in fact, PFC Bradley Manning? 

A. During the course of the chats I stated to 
the user, perhaps we could connect on Facebook. Once 
we did connect on Facebook, a social networking site 
with (inaudible) information, one another I ascertained 
that the name of the user was the same name as the 
sender of the emails which I previously received. 

Q. Is this something you do for most individuals 
that you chat with? 

A. Yes. Facebook is a very popular social 
network which many people connect . 
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Q. And what were your conclusions based off of 
your analysis of Facebook and comparing that to the 
chats? 

A. Based on the user description of themselves, 
both in the chats and on Facebook, as well as return 
email address, I ascertained that I was talking to 
somebody who (inaudible) Brad Manning, who was 
associated with the military network (inaudible) same 
user . 

Q . What was the moniker the user name used in 
chat between you and PFC Manning? 

A. I'm sorry. Mine or his? 
Q . Both . 

A. Mine was (inaudible) on AOL, (inaudible) . 
The defendant's was bradass87. 

Q. Did you only use the Pidgin program to chat 
for online? 

A. That is correct. 

Q. To chat using Pidgin (inaudible) the program? 

A. I used two different computers. 

Q. How many computers at the time did you have 
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access to? 

A. More than two, fewer than five. 

Q. Did you only use these two computers that you 
are referencing to chat with PFC Manning? 

A. Yes. 

Q. What were those two computers? 

A. One was a Lenovo Think Pad. The other was an 
HP mini- 

Q. Lenovo Think Pad, is that desktop, laptop? 

A. It is a laptop made by the successor IBM 
(inaudible) . 

Q. HP, describe that for the Court? 

A. It was the netbook, small, Low powered, 
mostly used online activity. 

Q. Where did you conduct these chats? 

A. In the state of various — at my residence, 
at Starbucks and at a different Starbucks, Safeway 
offering access. Internet cafe's and at home. 

Q. Did you record these chats? 

A. Yes, I did. 

Q. Was it your normal practice to record the 
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chats? 

A. At that time and possibly still by default 
recorded all chats. So, yes. 

Q. So did you activate, I guess, Pidgin, did you 
affirmatively tell Pidgin to record those chats? 

A. No. It's not evident to user that feature is 
enabled. I would have to disable it. 

Q. You had not done that? 

A . I had not . 

Q. You recorded all chats with all people? 
A. Yes, I did. 

Q. Did anyone else have access to these 
computers at the time you were chatting? 

A. No. Access is prevented by various 
countermeasures . 

Q. What do you mean by that? 

A. Encryption, password and physical 
inaccessibility . 

Q. Let's start with physical inaccessibility. 
How were they not physically accessible to anyone else? 

A. In that they were generally on my person. 
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When I went out, I went out usually with one I would 
talk with. 

Q. When did the chats first start? 

A. On or about May 20th of 2010. 

Q . When did they end? 

A. On or about May 26th of 2010. 

Q. You kept them on your person between those 

days? 

A. Computer geeks do not always leave the house 

much . 

Q. Did you keep them on yourself? 
A. Yes, I did. 

Q. When you went to Starbucks, you had both 
computers? 

A. No. As I say, I travel with one to Starbucks 
and (inaudible) . 

Q . And then what prevented someone in your 
quarters, or if you were at Starbucks, from accessing 
the actual information on the computer? 

A. They would require a password in order to 
access the computer. Then a pass phrase as well in 
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order to decrypt the drive . 

Q. How many people know that password or pass 
phrase? 

A. At the time only myself. 
Q. You didn't share that with anyone? 
A. No. I was the only authorized user and the 
only one capable of accessing that computer. 
Q. (Inaudible) 

A. (inaudible) June 12 of 2010. 
Q . Who did you meet with? 
A. Special Agent Toni Edwards. 
Q. Did Special Agent Edwards collect any 
evidence from you? 

A. Yes, he did. 

Q. What did he collect; what computer? 

A. He collected a hard drive from the Lenovo 
Think Pad and the HP mini in its entirety. 

Q. At the time he collected those were both the 
hard drives that you just spoke about both in working, 
proper working condition at the time? 

A. Yes, they were. 
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Q. Did you ever copy, make copies of those chat 
logs between the time of the chats and giving those 
computers and computer and hard drive to him? 

A. Yes, I did. 

Q. Did you ever manipulate, change, alter, 
delete, edit the original logs that were on your 
computers? 

A. The original logs as preserved by Pidgin were 
no way edited or redacted. 

Q. You did alter other versions of the logs? 

A. Yes. Ones which I shared. 

Q. What do you mean by "shared"? 

A. With people in the investigation. 

Q. You shared these logs at some point? 

A. Yes. 

Q. What people did you share the logs with? 
A. Kevin Poulsen and Ellen Kakashima 
Q. Those (inaudible) copies of the originals or 
alter copies? 

A. They were copied with retained redactions. 
Q. You did not alter the originals? 
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A. I did not . 

Q. How do you know that you did not alter the 
originals? 

A. At no time did I save them or even open them 
in any way capable of saving them. 

Q. When you surrendered digital media to Special 
Agent Edwards, did you sign over that evidence on 
custody form? 

A. Yes, I did. 

Q. Did you sign that form? 

A. Yes. 

Q. Did you give Special Agent Edwards any other 
laptops or computer hard drives? 

A. I gave Special Agent Edwards only the hard 
drive from the Lenovo and the HP Mini . 

Q. Now, Mr. Lamo, have you ever been diagnosed 
with mental health conditions? 

A. Yes, I have. 

Q. And what are those? 

A. Asperger Syndrome, autism, major depression 
and generalized anxiety. 
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Q. Do those conditions generally affect your 
memory? 

A. No, they do not. And they are not known to. 
Q. Do you take prescribed medications to assist 
you with living with those conditions? 
A. Yes, I do. 

Q. Have those medications ever affected your 
memory? 

A. They have, yes. 

Q. Have you ever used those medications in a 
manner that could affect your memory? 
A. Yes. 

Q. And would your chatting with PFC Manning in 
2010, were you using those medications in a way that 
affected your memory? 

A . I was not . 

Q. Between the time of your chats in May 2010, 
and turning over the hard drive and laptop to Special 
Agent Edwards in 2010, were you using those medications 
that in any way affected your memory? 

A . I was not . 
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Q. And today, Mr. Lamo, in this court martial 
and this testimony, are you suffering from any memory 
loss either from your diagnosed medical condition or 
medication use? 

A. No. 

MR. FEIN: No further questions, Your Honor. 
THE COURT: Defense. 

EXAMINATION BY MR. COOMBS 

BY MR. COOMBS: 

Q. Mr. Lamo, in early 2000, you committed a 
string of attacks against several large companies, 
correct? 

A. A string of offenses, yes. 

Q. In 2004, you pled guilty to computer fraud? 
A. Yes, I did. 

Q. You received a six month sentence, house 
arrest, two years probation? 
A. That's correct. 

Q. You were 22 years old at the time that you 
pled guilty? 

A. I was. 
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Q . Same age that PFC Manning was when he started 
the IM chat with you? 

A. That is also correct. 

Q. As you said, your IM chats began on or about 
the 20th of May 2010? 
A. Yes. 

Q. And you chatted until on or about the 26th of 
May 2010? 

A. That is also correct. 

Q. Now the day after your initial chat with PFC 
Manning you contacted law enforcement? 

A. That's correct. Well, (inaudible). 
Q. Law enforcement? 
A. Yes. 

Q. And you contacted law enforcement because you 
were concerned about the type of information that PFC 
Manning had shared with you? 

A. Yes. 

Q. You were also concerned for PFC Manning's 

life? 

A. Yes. 
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Q. And after contacting law enforcement you 
continued to chat with PFC Manning? 
A. That is correct. 

Q. And based on your conversations you 
determined that PFC Manning was young? 
A. Yes. 

Q. You believed he was ideologically motivated? 

A. That was my speculation, yes. 

Q. You also saw him as well intentioned? 

A. From his point of view, yes. 

Q . From your point of view you saw him as well 
intentioned? 

A. Subjectively, yes. 

Q. You also saw him as idealistic? 

A. Yes, I did. 

Q. Now you testified on direct that PFC Manning 
identified himself in the chat conversations. 
A. Correct. 

Q. And you testified on direct that he said 
Bradley Manning? 
A. Yes. 
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Q. Now he told you during your conversation that 
he wanted to disclose this information for public good? 

A. That was an interpretation, yes. 

Q. Based on your conversation you saw something 
very familiar about that? 

A. Yes. 

Q. You saw a young 22 year old with good 
intentions, much like you were? 
A. That was correct. 

Q. You did not know PFC Manning, correct? 
A. Not personally, no. 

Q. The two of your never met in person? 
A. No. 

Q. PFC Manning told you? 

MR. FEIN: Objection, hearsay. 

MR. COOMBS: It's not offered for the truth. 
To explain the conduct at this point . I can ask the 
question. I'll caution the witness not to answer 
before the objection and we'll see what my question is. 

THE COURT: Can you (inaudible) to ask the 
question (inaudible) research on you and the issue. 
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MR. COOMBS: I'm not offering it for the 
truth. (inaudible) just to explain the nature of this 
individual ' s response . 

THE COURT: The initial question wasn't that 
question. You can ask that question. 

MR. COOMBS: That was my question. PFC 
Manning told you he had done some background 
information on you . PFC Manning told you and then I 
got the objection. 

THE COURT : Is that the question you objected 

to? 

MR. FEIN: Yes. That PFC Bradley Manning 

told — 

THE COURT: I'm concerned about getting the 
hearsay. (Inaudible) 
BY MR. COOMBS: 

Q. In this instance were you made aware that PFC 
Manning knew facts about you? 

A. Yes. 

Q. And, in fact, you were a supporter of LBGT, 
correct? 
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A. Yes. 

Q. LBGT is Lesbian, Gay, Transgender Community? 
A. Yes. 

Q. And in 1998, you were appointed to the LBGT 
(inaudible) task force on the (inaudible) 
A. That is correct. 

Q. You also became a volunteer for gay and 
(inaudible) 

A. Yes. 

Q . PFC Manning knew that you were a threat 
analyst and Gray Hacker. Is that correct? 

MR. FEIN: Objection. Speculation. 
MR. COOMBS: (inaudible) 

MR. FEIN: It's hearsay based on what PFC 
Manning did or didn't tell him. 

THE COURT : It is hearsay . 

MR. COOMBS: (Inaudible) for the conversation 
not for the truth of the matter. To explain why PFC 
Manning reached out to him and the nature of that 
conversation . 

THE COURT: Alright. (Inaudible) The trial 
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is before me. It's hearsay. I'll disregard it. Go 
ahead . 

BY MR. COOMBS: 

Q . So you knew that he was aware that you were 
in Gray Hat Hacker, correct? 

A. Yes. 

Q. And what is a threat analyst? 

A. Analyst who involves (inaudible) threats and 
international threats they are (inaudible) or more. 

Q. What is a Gray Hat Hacker? 

A. A hacker is colloquially someone who 
performs, not always with permission, not for military 
purposes . 

Q. You also were aware that PFC Manning knew 
that you had donated to WikiLeaks? 

A. I recall that he referenced that he was aware 
because I mentioned WikiLeaks in connection with that . 
I don't know whether he knew I donated. 

Q. Essentially that was kind of why PFC Manning 
was reaching out to you? 

A. That was one reason, yes. 
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Q. Now I want to ask you some specific questions 
about your conversation with PFC Manning, okay? 
A. Yes. 

Q. Your conversation began with PFC Manning, of 
course, reaching out to you to make contact; is that 
right? 

A. Yes. 

Q. And he told you he was an intelligence 
analyst? 

THE COURT: Again, what is the basis for 

this? 

MR. COOMBS: In this instance probably for 
remainder of my questions the response (Inaudible) . 

THE COURT: That exception (inaudible) 

proceed . 

MR. COOMBS: (Inaudible) the declarant in 
this case, the individual to testify about declarant 
statement then . 

THE COURT: Existing statement. 

MR. COOMBS: So that's what I'm going after. 

THE COURT: Government, what is your 
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position? 

MR. FEIN: Can I have a moment, Your Honor. 
State of mind but (inaudible) answer was for the entire 
line of questioning. 
BY MR. COOMBS: 

Q. He told you he was an intelligence analyst? 

A. Yes. 

Q. He said to you, he thought he would reach out 
to somebody like you who would possibly understand? 
A. Yes. 

Q. During this initial chat conversation he told 
you about his life and his upbringing? 

A. In some amount of detail, yes. 

Q . He told you that he was being challenged due 
to a gender identity issue? 

A. Yes. 

Q. He also told you that he had been questioning 
his gender for years, but started to come to terms with 
that with his gender during the deployment? 

A. Yes. 

Q. He told you he believed he had made a huge 
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mess? 

A. Yes, he did. 

Q. And he confessed that he was emotionally 
fractured? 

A. Yes. 

Q. He said he was talking to you as somebody 
that needed moral and emotional support? 
A. Yes. 

Q. At this point he said he was trying not to 
end up killing himself? 

A. That is also correct. 

Q. He told you that he was feeling desperate and 
isolated? 

A. Yes. 

Q. He described himself as a broken sole? 
A. Yes, he did. 

Q . He said his life was falling apart and he 
didn't have anyone to talk to? 
A. Yes, he did. 

Q. And he said he was honestly scared? 
A. He also said that. 
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Q. 



He told you that he had no one he could 



trust? 

A. Correct. 

Q. And he told you he needed a lot of help? 

A. Yes, he did. 



occasions for pouring out his heart to you since you 
were total strangers? 
A. Correct. 



access to classified networks and so on, incredible 
things, awful things, things that belonged to the 
public domain, not on some servers dark room in 
Washington, D.C. What would you do? Do you recall him 
asking you that question? 
A. Yes, I did. 

Q. He told you he thought that the information 
that he had would have impact on entire world? 
A. That is also correct. 

Q. He said the information would disclose 
casualty figures in Iraq? 



Q. 



He ended up apologizing to you on several 



Q. 



Now at one point he asked you if you had 
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A. Yes. 

Q. He believed the State Department, First World 
Countries exploited the Third World Countries? 

A. He made that representation, yes. 

Q. And he told you that the cables detailed what 
was criminal political fact dealings? 

A. Yes. 

Q. He believed that everywhere there was a U.S. 
post there was a diplomatic scandal? 
A. That he did. 

Q. He told you that he believed it was important 
that the information got out? 
A. Correct. 

Q. He thought that if the information got out, 
it might actually change something? 
A. Yes. 

Q. He told you he did not believe in good guys 
versus bad guys anymore? 
A. Yes. 

Q. He only believed in a plethora of states 
acting in self-interest? 
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A. Correct. 

Q. He told you he thought he was maybe too 
idealistic? 

A. Correct. 

Q. He told you that he was always a type of 
person that tried to investigate to find out the truth? 

A. Something I could appreciate, yes. 

Q. And based upon what he saw, he told you he 
could not let information just stay inside? 

A. Yes. 

Q . He said he could not separate himself from 
others? 

A. Correct. 

Q . He felt connected to everybody? 
A. Yes. 

Q. Even told you it felt like we were all 
distant family? 

A . Engagement . 

Q. And he said he cared? 

A. Yes. 

Q. He told you that he thought he would keep 
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track — keep track of people that his job impacted? 
A. Correct. 

Q. And he wanted to make sure that everybody was 

okay? 

A. Yes. 

Q. He told you that the way he separated himself 
from other analysts was, he cared about people? 
A. He said that, yes. 

PFC Manning told you he followed humanist 



Q 

values? 
A 



it? 



A. 

Q. 
A. 



Yes, he did. 

He said he had dogs tags saying "humanist" on 



Yes 



Do you know what it means to be a humanist? 
From my understanding the importance of human 
life and human beings and has a structure of morality . 

Q. PFC Manning told you that at the time he was 
feeling (inaudible) and no one seemed to see that or 
care? 

A. Yes. 



Provided by Freedom of the Press Foundation 



1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 



UNOFFICIAL DRAFT - 6/4/13 Morning Session 



68 

Q . He told you that he was bothered that nobody 
seemed to care? 

A. Yes, he did. 

Q . He said he thought apathy was far worse than 
active participation? 
A. Yes. 

Q. He told you that he preferred the truth 
(Inaudible) ? 

A. Yes, he did. 

Q. He also told you that he was maybe too 
traumatized to really care about the consequences to 
him? 

A. Yes. 

Q . He told you that he wasn ' t brave . He was 

weak? 

A. Yes. 

Q. He said he was not so much scared of getting 
caught and facing consequences as he was of being 
misunderstood? 

A. Yes. 

Q . At one point you asked him what his end game 
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was, correct? 

A. Yes, I did. 

Q. And he told you, hopefully worldwide 
discussions, debates and reforms? 
A. Yes, he did. 

Q. He told you that the reaction to the 
(Inaudible) ? 

A. Yes. 

Q . And he said he wanted people to see the 
truth? 

A. Correct. 

Q . He said without information you can ' t make 
informed decision as a whole? 
A. Yes, he did. 

Q. And he told you to, he was hoping that people 
would actually change if they saw the information? 
A. Correct. 

Q. He also told you that he recognized that he 
may be just young, naive and stupid? 
A. Yes. 

Q . And at one point you asked him why he didn ' t 
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just sell the information to Russia or China? 
A. Correct. 

Q. And he told you that the information belonged 
in the public domain? 

A. Yes, he did. 

Q. He believed that information was in the 
public domain and should be for the public good? 
A. Yes. 

Q . You asked him how long he had been helping 
out WikiLeaks at one point? 
A. Yes, I did. 

Q. He told you that he essentially had been — 
THE COURT: Sustained. Hearsay. 
MR. COOMBS: Very well, Your Honor. 
BY MR. COOMBS: 

Q. At one point he told you that his belief or 
his feelings were that he wanted to eventually go into 
politics? 

A. Yes. 

Q. And at the time he was thinking that humanity 
could accomplish a lot, if smart people with ideas 
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cooperated with each other? 
A. Correct. 

Q. At anytime did he say he had no loyalty to 
America? 

A. Not in those words, no. 

Q. At anytime did he say the American flag 
didn ' t mean anything to him? 
A. No. 

Q. At anytime did he say he wanted to help the 
enemy? 

A. Not in those words, no. 

MR. FEIN: Thank you. Your Honor. 
EXAMINATION BY MR. FEIN 

BY MR. FEIN: 

Q. Did PFC Manning say he knew Julian Assange? 
A. Yes, he did. 

Q. Did PFC Manning disclose he had classified 
information, downloaded thousands of documents? 
A. Yes, he did. 

Q. Also, Mr. Lamo, when did PFC Manning start 
talking to you, what day was that? 
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A. On or about May 20th of 2010. 
Q. That's the end of May 2010? 
A. Yes. 

MR. FEIN: Thank you, Mr. Lamo . No further 
questions, Your Honor. Can we have a brief recess to 
confer? 

THE COURT: We will not recess. Go ahead and 

confer . 

(Pause) 

THE COURT: Lastly, you are permanently 
excused. You are free to go or you can stay in the 
courtroom. 

THE WITNESS : Thank you . 

MR. FEIN: United States has multiple 
stipulations at this point . 

MR. COOMBS: Your Honor, could we take a 
brief ten— minute comfort break . 

THE COURT : Alright . Court is in recess 
until 11:15. Let me see you one moment, both sides, in 
my chambers . 

(Brief Recess) 
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THE COURT: Again, the parties are present in 
the Court — there is an additional party. 

MR. FEIN: Captain Whyte is present. 
THE COURT : Is the Government ready to 

proceed? 

MR. FEIN: We have three stipulations of 
expected testimony. Special agent Charles Clapper, 3 
June 2013 PE27 . Hereby agreed (inaudible) accused 
defense counsel, trial counsel if Special Agent Charles 
Clapper with present to testify during the merits of 
presentencing phases of this court martial, testify 
substantially as follows : 

I'm a special agent for the U.S. Army 
Criminal Investigation Division, CCIU. Specifically I 
work for the CCIU Investigative Unit, CCIU, current job 
title special agent in charge (inaudible) of Arizona 
branch office located in (inaudible) 

As the SAC I run a two— man office that 
handles exclusively computer crimes . My job also 
entails serving as CCIU's liaison officer for 
additionally liaison officer to the regional computer 
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emergency response team. That's another network 
operation securities center (inaudible) . 

I have served Arizona Special Agent for 
five years and I have been the SAC for three of those 
five years. 1986 to 1999 I was enlisted military 
police officer, MP. I served as investigation section 
of (inaudible) Washington from 1993 to 194. 

After becoming Agent in (inaudible) 19 
from 1999 to 2002 I serves as computer crimes 
coordinator for the 5th MP, (inaudible) . I was also 
the evidence custodian for the (Inaudible) in 2001 to 
2002. 

I served as (inaudible) sergeant in 
(inaudible) from 2004 to 2006 CCIU or (inaudible) , 
Virginia. In 2007 I was (inaudible) contractor 
performing forensic (inaudible) army computer emergency 
response team in (inaudible) . 

Became (inaudible) Arizona in 2008 and 
currently serve in this capacity. I received bachelors 
degree (inaudible) located in New York. I have had 
extensive (inaudible) evidence, handling this includes 
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(inaudible) course also advanced (inaudible) in assault 
Special Agent course in Army (inaudible) Georgia. 

In terms of training I have taken 
numerous courses at the Defense (inaudible) Maryland. 
Took these courses between the year 2000 and 2008. 
They covered a full range of (inaudible) and digital 
media collection issues. 

Between 2003 and 2006 I attended two 
courses (inaudible) software Reston, Virginia. This 
company (inaudible) EnCase . In 2012 I attended Federal 
Law Enforcement Training Center, computer network 
training program in, Georgia. 

These courses all discussed the 
collection, handling of digital evidence. I have the 
Department of Cyber Certificate from the DoD which is 
the highest certification that one can receive in the 
field. 

The certification must be renewed every 
two years. I received my first certification in 2006. 
(inaudible) Last October 2012. In addition to my 
training and certification I worked for 100 cases 
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current duty position in 100 and to 200 cases in my 
previous capacity . 

I (inaudible) evidence. Review custody 
also, then matches evidence attached. I check for 
(Inaudible) . I ensure the appropriate information such 
as dates and time are properly recorded. 

Maintain secure custody of evidence 
prior to transferring it to another individual . In 
this particular investigation I worked with Special 
Agent Toni Edwards, assisted with witness interviews 
and handling evidence . 

12 June 2010 I received evidence 
relating to this investigation from Special Agent 
Edwards . I also received to consent Form 87— signed by 
Mr. Lamo on 12 June, 2010, which signing consent to law 
enforcement personnel to search electronic devices for 
all information in any form pertaining to 
communications which made in the form emails, digital 
messages, documents, data communications made, computer 
log files (inaudible) any other data, encrypted plain 
text, any other format relating to Bradley E. Manning 
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on the disclosure of classified information or 
information which property of the United States 
Government . 

The first piece of evidence collected 
was a Lenovo laptop computer, Fujitsu hard drive, 
Serial Number K4 0T812 (inaudible) Item 1, DA Form 
marked as document number DN 7 610 known as (inaudible) 
hard drive. It was collected from (inaudible) to 
California, 12 June. 

The second piece of evidence was HP mini 
(inaudible) computer CN90513VT with computer, hard 
drive 51E2K recorded 4137 marked as document DN7710 and 
known as Lamo HP Fujitsu hard drive. It was collected 
(inaudible) Mr. Lamo 12 June 2010. 

As I mentioned, both standard forensic 
(inaudible) software which is original (inaudible) 
Original information on hard driver . Using the DA Form 
4137 I properly released the original evidence back to 
Special Agent Edwards on 14 June 2010. 

While in possession of these items I 
maintained control . I returned the item in the same 
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condition that I received them. I have no reason to 
believe that the evidence was damaged or contaminated 
in any way . 

After releasing the evidence to Special 
Agent Adrian Edwards, I had no further interaction with 
this evidence . 

Stipulation expected Gary Young, dated 
the 3, June 2013 PE28. Hereby (inaudible) agreed trial 
counsel were present to testify presentencing phases of 
this court martial he would as follows : 

I am currently criminal intelligence 
Program Manager CCIU. Of the CID . I have been with 
CCIU for 10 years. 

This position primarily entails 
reviewing cases for entering them into database . 
Reports (inaudible) alternative evidence custodian. 
Alternate evidence custodian. I held this position for 
10 years. 

Associates degree, Central Texas 
College. Military 1980. '87 I became military police 
investigator. From 1989 to 1992 (inaudible) of 
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investigation in Germany. During this time 1989 to 
1991 I was also the evidence custodian. 

I joined CID in (inaudible) from 1994 to 
1995 I was the alternate evidence custodian while 
(inaudible) in career. From 1995 to 1998 (inaudible) 
senior enlisted advisor primary evidence custodian. 

From 1998 until I retired in 2000, I 
worked CID headquarters on (inaudible) . After three 
years working for 2003, I returned to the criminal 
investigation by joining (inaudible) . I have worked in 
my current since then serving from 2003 to 2006 
situational awareness alternate occasionally primary 
items custodian at various times . 

Throughout my years in law enforcement I 
have worked more than 800 cases. In 1996 I took the 
medical (inaudible) investigation training by the Armed 
Forces Institute pathology held at Fort Lewis . 

In 2005 I attended evidence management 
course the United States Army Crime Lab in Georgia . In 
2007 I returned to (inaudible) lab Special Agent 
laboratory training. 
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These courses do cover physical and 
digital (inaudible) . I followed several handling 
evidence as evidence custodian . First time I receive a 
piece of evidence, I checked (inaudible) evidence 
custody document to make sure the evidence matches the 
description and that the marked for identification 
number on the evidence matches what is recorded on the 
form. 

I also check to make sure the form has 
been appropriately filled out and I sign the evidence 
into the evidence room. I sign in the receipt column. 
I then walk it into the evidence bought database before 
placing it in the evidence room. 

When someone asks to receive a stored 
piece of evidence, I pull voucher number and locate the 
evidence in its appropriate location. I check to make 
sure the evidence I am handling matches the description 
on the form and release it to the special agent for 
(inaudible) that is requested it. 

I sign that I have released it and the 
individual receiving it signs that he, that she has 
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received it. Each time I relinquish or assume custody 
of evidence, I check the description, make sure the 
evidence being transferred matches the forms used to 
transfer. It in my capacity as evidence custodian, I 
worked with Special Agent (inaudible) and (inaudible) 

(inaudible) . It's normal for her to 
sign evidence room for me to sign it back in. 

I am involved in the present case 
because my role in assisting the investigation team 
with the secure storage evidence they collected I have 
received evidence from Special Agent Edwards and 
(inaudible) . 

15 June 2010 I received evidence related 
to this investigation from Special Agent Edwards . I 
took custody of Lenovo laptop computer, Fujitsu hard 
drive, Serial Number (inaudible) . Collected from Mr. 
Lamo while Sacramento, California, 1 June 2010. 
Recorded time D4137 marked as document 7 6—10 and known 
as Lamo hard drive . 

I also took HP mini computer, number 
(inaudible) CN90513VT with HP computer hard drive, 
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Serial Number (inaudible) collected from Mr. Lamo in 
Sacramento, California 12 June, 2010. (inaudible) 

Upon taking possession I logged it into 
the evidence using proper procedures . I never logged 
it back out. 15 June 2010 (inaudible) evidence related 
to this investigation (inaudible) I took custody of 
(inaudible) VD marked (inaudible) 
0028-102CID221-10117DEPT of state server log, 
199.56.188.73. Seized on 15 June 2010. Recorded time 
DA form marked as DN78— 10 known as DOS serve logs. 

Taking possession I walked into the 
evidence room, using proper procedures I described 
earlier . I never logged it back out . 

Your Honor, stipulation of expected 
testimony from (inaudible) Marina, 3 June, 2013, 
Prosecution Exhibit 29. It is hereby agreed by the 
(inaudible) were present to testify during merits 
phases court martial, would testify essentially as 
follows : 

I am the primary evidence custodian of 
the (inaudible) Investigation CID Quantico, Virginia. 
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I have held this position since 2006. In this position 
I track and catalog evidence maintained by CCIU office. 

I have been certified evidence custodian 
since January of 2006. I received this certification 
from U.S. Army Criminal Investigation Laboratory since 
January 2010. I have also (inaudible) defense 
investigation training academy certified digital media 
collector . 

I follow general procedures . The first 
evidence I check the accompanying (inaudible) 47 
custody document to make sure it matches the 
description and the marked for identification over 
evidence matches what is recorded on the form. 

I also check to make sure the form has 
been properly filled out. I sign the evidence to the 
evidence room. I sign in the receipt column item log 
it into evidence book and database before preserving it 
into the evidence room. 

After receiving stored piece I pull 
voucher number, locate the evidence in the appropriate 
location. I check to make sure the evidence I'm 



Provided by Freedom of the Press Foundation 



1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 



UNOFFICIAL DRAFT - 6/4/13 Morning Session 



84 

handing over matches the description on the form, 
release it to the special agent, referring to the 
examiner who has requested it . 

I sign that I have released it and the 
individual receiving it signs that he or she has 
received it . Each time relinquish or assume custody of 
evidence I check the description to make sure the 
evidence being transferred matches the form used to 
transfer it . 

I first became involved in the present 
case because of my role in assisting the investigation 
team. I signed several piece evidence from the 
investigation agent and further (inaudible) into the 
evidence room and release back to them when they needed 
it for their investigation or examination. 

In my role as evidence custodian I 
worked with and receive evidence from Special Agent 
Kirk Ellis, Special Agent Edwards, Davis Shaver, 
Special Agent (inaudible) , Special Agent John 
(inaudible) . I also know Gary Young. He used to be 
the primary evidence custodian when I began working for 
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Army CCIU. Mr. Young currently serves as (inaudible) . 

In June 2010, one Lenovo laptop computer 
with (inaudible) hard drive, Serial Number (inaudible) 
K4014 (Inaudible) collected from (inaudible) on 12 
June, 2010, recorded as time one DA form 4137 marked as 
Document Number DN7 6— 10 and known as (inaudible) hard 
drive . 

Referring to (inaudible) for 
examination. I also sign out HP mini (inaudible) CID 
hard drive, Serial Number 5 (inaudible) collected from 
(inaudible on 12 June (inaudible) DA form 4137 marked 
as DN77— 10 known as (inaudible) HP hard drive to 
Special Agent Shaver for the same reason. 

Returned these items that same day. I 
received release evidence according to the proper 
procedures I just described. I did not alter this 
evidence in any way . 

On (inaudible) 10 related to 
investigation from Special Agent Wilbur recorded in 
Item 1 DA (inaudible) 4137 marked DN15 . CD marked 
WikiLeaks (inaudible) , 13 October 10 (inaudible) from 
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Upon receiving this evidence I properly 
logged it into the evidence room using the same 
procedures described earlier. November 2010 
temporarily released it to Shaver for examination . He 
returned it later that same day. I (inaudible) 
released evidence (inaudible) described earlier. I did 
not alter this evidence in any way. 

On 3 November 2010, I received 19 pieces 
of evidence from (inaudible) , 2 November, 2010 recorded 
Items 1 through 19 on DA Form, Form 4137 marked as 
DN162-10 . 

Item 2 on this DA form, Form 4137 was SD 
memory card Serial Number (inaudible) SD card. 

On 10 December 2010, I released SD card 
to Special Agent Shaver for examination. He returned 
it later that same day . I appropriately received the 
evidence back into the evidence room according to the 
proper procedures I described earlier . I did not alter 
this evidence in any way . 

That ' s the end of the three stipulations 
of testimony. And United States will move to admit 
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what has been marked as Prosecution Exhibits 13 and 14 
for identification as Prosecution Exhibit 13 and 14 
respectively . 

(Pause) 

MR. FEIN: United States requests a lunch 
recess a little earlier, requesting two-hour lunch 
recess in order for the parties to work on 
administrative issue. 

MR. COOMBS: No objection, Your Honor. 

THE COURT: Alright. We'll come back at 
1345. That will be 1:35 in civilian parlance. 

THE COURT: 45. I'm sorry. 1345 or 1:45 in 
civilian parlance. Court is recessed until 1:45. 

(The trial recessed at 11:40 a.m.) 
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